# Supero (remote · api.supero.dev)

Build multi-tenant apps over MCP. Schemas, CRUD, deploys — access control enforced server-side.

- Trust score: 85/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-30

## Components

- remote · `api.supero.dev`: 85/100 (this document), [markdown](https://verifymcp.io/servers/supero-platform-supero/mcp-v1-messages.md), [page](https://verifymcp.io/servers/supero-platform-supero/mcp-v1-messages)

## Channel facts

- Endpoint: `https://api.supero.dev/mcp/v1/messages`
- Transports: `streamable-http`
- Auth: `required`
- Version: `2.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-30.

- **Endpoint Security**: 89/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 7502 tokens (~115/item across 65 items; 64 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 67/100
  - Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 96/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 87% of tool parameters carry a description.
- **Tool Safety**: 95/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - 4 of 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "build_deploy_status" implies "deploy" and declares readOnlyHint instead, contradicting what its own name says it does.
  - An AI judge read all 66 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 40/100
  - Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28.

## Install

### How do I install the Supero MCP server?

Supero is a hosted endpoint at https://api.supero.dev/mcp/v1/messages, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http supero-platform-supero 'https://api.supero.dev/mcp/v1/messages'
```

### Cursor

```json
{
  "mcpServers": {
    "supero-platform-supero": {
      "url": "https://api.supero.dev/mcp/v1/messages"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "supero-platform-supero": {
      "type": "http",
      "url": "https://api.supero.dev/mcp/v1/messages"
    }
  }
}
```

### Codex

```toml
[mcp_servers.supero-platform-supero]
url = "https://api.supero.dev/mcp/v1/messages"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "supero-platform-supero": {
      "type": "remote",
      "url": "https://api.supero.dev/mcp/v1/messages",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add supero-platform-supero --url 'https://api.supero.dev/mcp/v1/messages' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  supero-platform-supero:
    url: "https://api.supero.dev/mcp/v1/messages"
```

### Netclaw

```json
{
  "McpServers": {
    "supero-platform-supero": {
      "Transport": "http",
      "Url": "https://api.supero.dev/mcp/v1/messages"
    }
  }
}
```

### Vellum

```bash
assistant mcp add supero-platform-supero -t streamable-http -u 'https://api.supero.dev/mcp/v1/messages'
```

### Other

```json
{
  "mcpServers": {
    "supero-platform-supero": {
      "type": "http",
      "url": "https://api.supero.dev/mcp/v1/messages"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-29 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-28 (score 84, 0)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-27 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-25 (score 83, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-23 (score 82, +5)

- [security improvement] HTTPS: unverified → pass

### 2026-09-22 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-20 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (64)

### `crud_search` (~211 tokens)

Search/list objects of any type in the current domain. Use schema_list first to discover available object types. System types: project, tenant, user_account, api_key, connector, audit_log, schema_registry, client_sdk, connector_execution, connector_plugin. Domain types vary per domain (e.g. customer, invoice, appointment, vehicle).

Input parameters:

- `detail` (boolean): Include full object data (default: true)
- `filters` (object): Filter criteria as key-value pairs (e.g. {"status": "active"})
- `limit` (integer): Max results (default: 100)
- `object_type` (string, required): The object type to search (e.g. 'customer', 'project', 'tenant', 'connector')
- `offset` (integer): Skip N results for pagination
- `tenant` (string): Optional tenant name to scope the search to (multi-tenant apps: verify a specific named tenant's data). Omit for single-tenant apps — the session/API-key tenant is used.

### `crud_get` (~51 tokens)

Get a specific object by UUID from the current domain.

Input parameters:

- `object_type` (string, required): The object type (e.g. 'customer', 'project', 'tenant')
- `uuid` (string, required): Object UUID

### `crud_create` (~178 tokens)

Create a new object in the current domain. Use schema_list to see available types and their fields.

Input parameters:

- `data` (object): Object fields as key-value pairs
- `name` (string, required): Object name (required for most types)
- `object_type` (string, required): The object type to create (e.g. 'customer', 'appointment', 'project')
- `parent_fq_name` (array): Parent FQ name path (e.g. ['cine-corp', 'car-service'])
- `parent_type` (string): Parent type if applicable (e.g. 'project' for tenant, 'domain' for project)
- `tenant` (string): Optional tenant name to create the object under (multi-tenant apps: seed a specific named tenant's data). Omit for single-tenant apps — the session/API-key tenant is used.

### `crud_update` (~91 tokens)

Update an existing object in the current domain.

Input parameters:

- `data` (object, required): Fields to update
- `object_type` (string, required): The object type
- `tenant` (string): Optional tenant name context for this update (multi-tenant apps). Omit for single-tenant apps — the session/API-key tenant is used. Updates address the record by UUID.
- `uuid` (string, required): Object UUID to update

### `crud_delete` (~80 tokens)

Delete an object from the current domain.

Input parameters:

- `object_type` (string, required): The object type
- `tenant` (string): Optional tenant name context for this delete (multi-tenant apps). Omit for single-tenant apps — the session/API-key tenant is used. Deletes address the record by UUID.
- `uuid` (string, required): Object UUID to delete

### `schema_list` (~17 tokens)

List all existing schemas in the current domain.

### `schema_get` (~59 tokens)

Get full details of a specific schema by UUID. Returns the complete schema definition including all attributes and metadata.

Input parameters:

- `include_content` (boolean): Include full schema content (default: true).
- `schema_uuid` (string, required): UUID of the schema to retrieve.

### `schema_validate` (~49 tokens)

Validate schemas before saving. Checks for conflicts with existing schemas, circular dependencies, reserved names, and parent_type correctness. Always validate before saving!

Input parameters:

- `schemas` (array, required): Array of schema definitions to validate.

### `schema_save` (~279 tokens)

Save/upload schemas to the domain. Schemas are validated before saving. Returns list of successfully saved schemas with their UUIDs. 

IMPORTANT: Pass FLAT schema objects directly — do NOT wrap in schema_content. The tool handles schema_type detection and wrapping automatically. 

Required fields: name, parent_type, prefix, plural_name, attributes, description. 

Supported attribute types: 'string' for text, 'float' for decimal numbers (NOT 'number'), 'integer' for whole numbers, 'boolean' for true/false. 

Optionally pass project_uuid to auto-link saved schemas to a project. 

Example:
{
  "schemas": [{
    "name": "product",
    "description": "Product catalog entry",
    "parent_type": "tenant",
    "prefix": "prd",
    "plural_name": "products",
    "attributes": [
      {"name": "title", "type": "string", "required": true},
      {"name": "price", "type": "float"},
      {"name": "stock", "type": "integer"}
    ]
  }]
}

Input parameters:

- `project_uuid` (string): Optional project UUID to auto-link saved schemas to.
- `schemas` (array, required): Array of schema definitions to save.
- `skip_existing` (boolean): Skip schemas that already exist (default: true).

### `schema_delete` (~50 tokens)

Delete a schema from the domain. Use with caution.

Input parameters:

- `force_delete` (boolean): Force delete even with dependencies (default: false).
- `schema_uuid` (string, required): UUID of the schema to delete.

### `schema_list_project` (~76 tokens)

List schemas linked to the current project.

Input parameters:

- `include_content` (boolean): Include full schema content (default: true).
- `project_uuid` (string): Project to list schemas for. Optional; defaults to the key's project when resolvable (pass the project_uuid from build_whoami/build_list_projects under an API key).

### `schema_update` (~74 tokens)

Update an existing schema definition.

Input parameters:

- `check_compatibility` (boolean): Check compatibility with existing data (default: true).
- `new_version` (string): Optional new version string.
- `schema_content` (object, required): New schema content (full schema definition).
- `schema_uuid` (string, required): UUID of the schema to update.

### `project_link_schemas` (~77 tokens)

Link schemas to a project. Accepts schema UUIDs or names.

Input parameters:

- `project_uuid` (string, required): UUID of the project to link schemas to.
- `schema_names` (array): List of schema names to link (resolved to UUIDs).
- `schema_uuids` (array): List of schema registry UUIDs to link.

### `sdk_generate` (~66 tokens)

Generate client SDKs for the domain's schemas.

Input parameters:

- `force_rebuild` (boolean): Force rebuild (default: false).
- `include_docs` (boolean): Include docs (default: true).
- `languages` (array): Languages to generate (default: ['python', 'javascript']).

### `sdk_status` (~27 tokens)

Check SDK generation request status.

Input parameters:

- `request_id` (string, required): Request ID from sdk_generate.

### `sdk_list` (~41 tokens)

List available SDKs for the current domain.

Input parameters:

- `language` (string): Filter by language.
- `limit` (integer): Max results (default: 50).

### `sdk_download` (~41 tokens)

Get download URL for an SDK.

Input parameters:

- `artifact` (string): Artifact type (default: 'wheel').
- `sdk_uuid` (string, required): UUID of the SDK.

### `rbac_get_my_access` (~21 tokens)

Get current user's role, permissions, and scope.

### `rbac_check_permission` (~43 tokens)

Check if the current user has a specific permission.

Input parameters:

- `permission` (string, required): Permission to check (e.g. 'schema:manage', 'data:write').

### `apikey_get_scope` (~21 tokens)

Get the scope and permissions of the current API key.

### `connector_run` (~37 tokens)

Trigger a manual connector sync execution.

Input parameters:

- `connector_id` (string, required): UUID of the connector.
- `params` (object): Optional execution parameters.

### `connector_cancel` (~40 tokens)

Cancel a running connector execution.

Input parameters:

- `connector_id` (string, required): UUID of the connector.
- `execution_id` (string, required): UUID of the execution to cancel.

### `connector_status` (~27 tokens)

Get connector status and recent executions.

Input parameters:

- `connector_id` (string, required): UUID of the connector.

### `connector_enable` (~26 tokens)

Enable a connector for scheduling.

Input parameters:

- `connector_id` (string, required): UUID of the connector.

### `connector_disable` (~24 tokens)

Disable a connector.

Input parameters:

- `connector_id` (string, required): UUID of the connector.

### `connector_discover` (~40 tokens)

Trigger schema/metadata discovery for a connector.

Input parameters:

- `connector_id` (string, required): UUID of the connector.
- `params` (object): Optional discovery parameters.

### `connector_discover_status` (~40 tokens)

Get discovery execution status.

Input parameters:

- `connector_id` (string, required): UUID of the connector.
- `execution_id` (string, required): UUID of the discovery execution.

### `connector_discover_results` (~39 tokens)

Get discovery results.

Input parameters:

- `connector_id` (string, required): UUID of the connector.
- `execution_id` (string, required): UUID of the discovery execution.

### `connector_test_config` (~25 tokens)

Test a connector configuration.

Input parameters:

- `config` (object, required): Connector config to test.

### `connector_test` (~27 tokens)

Test an existing connector's connectivity.

Input parameters:

- `connector_id` (string, required): UUID of the connector.

### `connector_plugins` (~13 tokens)

List available connector plugins.

### `build_get_skills` (~277 tokens)

Fetch a Supero build reference. doc='skills' (default, the spec you MUST follow) | 'components' (the real pre-built SDK component/global catalog — read so you don't reinvent UI) | 'rubric' (the rich-app quality checklist — what 'stunning' means) | 'landing' (compact landing-page derivation + quality bar — MANDATORY read for public-facing apps) | 'integrations' (the EXACT services.* wrapper→service_id→args map for email/sms/stripe/ai/etc.) | 'web' / 'transactional' / 'workflows' / 'mobile' / 'services' (deep companion docs) | 'e2e_testing'. Returns the doc + a content version + the SDK floor to pin. Read 'skills' FIRST, then 'components' + a matching build_get_examples before you author UI. Docs are PAGED (~32KB/section): when the header says more:true, fetch the next section with offset=<next_offset> — never re-fetch from 0.

Input parameters:

- `doc` (string): Which doc (default 'skills').
- `max_bytes` (integer): Max bytes to return per section (default ~32000).
- `offset` (integer): Byte offset to start from (for paging large docs; default 0).

### `build_get_examples` (~276 tokens)

Fetch a COMPLETE, production-quality reference app (schemas.py + config.py + setup.py + ui/app.js) to copy patterns from — the single biggest lever for app quality. archetype='index' (default) lists the available archetypes with per-file byte sizes; pick the one closest to your app ('commerce-marketplace' | 'service-booking' | 'ops-dashboard' | 'multitenant-portal' | 'saas-billing') and fetch it BEFORE authoring your UI. These are real 'stunning' apps; mirror how they compose the SDK components, art-direct the landing page, and structure schemas. Optional file= to fetch just one file ('schemas.py' | 'config.py' | 'setup.py' | 'ui/app.js'). Responses are PAGED (~32KB/section): when the header says more:true, fetch the next section with offset=<next_offset> — never re-fetch from 0.

Input parameters:

- `archetype` (string): Which reference app (default 'index' to list them).
- `file` (string): Optional: return only this one file instead of the whole bundle.
- `max_bytes` (integer): Max bytes to return per section (default ~32000).
- `offset` (integer): Byte offset to start from (for paging; default 0).

### `build_plan` (~264 tokens)

PLAN FIRST — turn a one-line app idea into an explicit BUILD CHECKLIST before you author anything, so a thin prompt doesn't silently skip what expert builders add (this is exactly why first-draft apps miss detail pages, tenant pickers, seed data). Deterministic, no LLM: it detects the app's VERTICAL and returns the authentic page structure + terminology for that domain, which entities need a full DETAIL PAGE, the multi-tenant login pattern (picker + tenant=''), seed guidance, and which build_get_examples to copy. Call it right after build_get_skills and BEFORE authoring.

Input parameters:

- `description` (string, required): The app idea in a sentence or two (e.g. 'portal for Karnataka polytechnic colleges with admin + student portals').
- `entities` (array): Optional: the main entity/noun names (e.g. ['college','course','student']). Sharpens the per-entity detail-page + seed guidance.
- `is_multi_tenant` (boolean): Optional: true if each customer/org (college/clinic/branch) is a separate tenant. Inferred from the description if omitted.
- `public_facing` (boolean): Optional: true if end-users/the public browse it (vs an internal-only tool). Inferred if omitted.

### `build_get_service_contract` (~241 tokens)

Fetch the AUTHORITATIVE contract for a transactional/stateful platform service (cart, order, payment, booking, appointment, membership, approval, document_signature, recurring_plan, inventory, task, ticket, loyalty_points, rental, comment, attachment, feedback, notification, product, service, customer, workflows). Returns the service's state machine (initial_state + transitions), its operations (op ids + input fields + resulting state), the base schemas + mandatory fields you must supply, AND the platform's DEFAULT UI SCHEMAS for that service — the bulletproof reference for building a correct, sophisticated transactional UI. ALWAYS call this for any service your app `extends` BEFORE authoring its UI — do not guess op names, states, or mandatory fields from prose. service_id='index' (default) lists all services.

Input parameters:

- `parts` (string): What to return (default 'both'): 'contract' = state machine/ops/schemas; 'ui_schemas' = default UI only.
- `service_id` (string): The service id (e.g. 'cart', 'booking', 'payment'); 'index' (default) lists all.

### `build_whoami` (~43 tokens)

Resolve your API key's scope: role (domain_admin/project_admin), domain, whether you can create projects, and your plan. Call this to decide the flow.

### `build_list_projects` (~39 tokens)

List projects you can build into (uuid, name, schema_namespace, live_url).

Input parameters:

- `limit` (integer): Max results (default 50).

### `build_get_project` (~115 tokens)

Get one project's details: schema_namespace (use this EXACT value as the `namespace` literal on every schema dict), last published version, AND the captured `project_intent` — the brief (project_description/summary), the discovered data model (entities/central_entity/relationships/status_workflows), and the landing intent (public_landing_view). BUILD TO THIS — it's the authoritative app spec the user already gave; don't re-ask or ignore it.

Input parameters:

- `project_uuid` (string, required): Project UUID (from build_list_projects).

### `build_create_project` (~136 tokens)

Create a NEW project (domain-admin keys only; plan-gated). Mints the project's schema_namespace + an API key (returned ONCE). Use for a fresh app.

Input parameters:

- `description` (string): Optional: what the app is for — persisted on the project so future sessions build to it.
- `display_name` (string)
- `name` (string, required): Project name/slug.
- `requirements` (array): Optional: the confirmed requirements/plan bullets — persisted on the project record (future sessions read them via build_get_project).
- `schema_namespace` (string): Optional; server normalizes/derives if omitted.

### `build_update_project` (~43 tokens)

Update a project's metadata (display_name, description, show_public, live_url).

Input parameters:

- `patch` (object, required): Fields to update.
- `project_uuid` (string, required)

### `build_set_project_mode` (~67 tokens)

Set a project's build mode. 'dev' (default) allows COMPLETE REPLACE (wipe data, keep credentials); 'live' protects it. Switch to dev before replacing, to live when it's in production.

Input parameters:

- `mode` (string, required)
- `project_uuid` (string, required)

### `build_replace_project` (~243 tokens)

DESTRUCTIVE (DOMAIN-admin keys only): completely replace a DEV-mode project's app — wipes its data (retains credentials, API keys, namespace, tenant). Refused if mode='live'. Requires confirm_project_name to match. If you pass files, they are VALIDATED before any wipe (a bad bundle is a no-op) and published after; otherwise wipe-only, then call build_publish.

Input parameters:

- `app_type` (string)
- `confirm_project_name` (string, required): Must equal the project's name — a safety confirmation.
- `files` (object): Optional new bundle {path: content} to publish after the wipe.
- `files_b64gz` (string): Alt to files: base64(gzip(JSON {path:content})). Use if a CDN/WAF blocks raw code in the body.
- `files_ref` (string): For a LARGE bundle that exceeds the model output-token cap: a file_id from build_stage_bundle (upload the gzip(json {path:content}) blob out-of-band, then pass its file_id here). Preferred over files…
- `project_uuid` (string, required)

### `build_validate` (~186 tokens)

Validate a locally-authored bundle against the live platform BEFORE publishing. AST-only (your code is never executed). Checks manifest, syntax, import-safety, config exports, schema validity, and namespace==project schema_namespace.

Input parameters:

- `files` (object, required): Map of {relative_path: file_content} for the bundle.
- `files_b64gz` (string): Alt to files: base64(gzip(JSON {path:content})). Use if a CDN/WAF blocks raw code in the body.
- `files_ref` (string): For a LARGE bundle that exceeds the model output-token cap: a file_id from build_stage_bundle (upload the gzip(json {path:content}) blob out-of-band, then pass its file_id here). Preferred over files…
- `project_uuid` (string): Target project (for namespace/schema checks).

### `build_publish` (~212 tokens)

Package + upload your authored bundle and record a version under the project. Returns version_uuid + file_id + download_url. Runs build_validate first unless force=true. Provide files as {relative_path: content}.

Input parameters:

- `app_type` (string): Default 'web'.
- `files` (object, required): Map of {relative_path: file_content}.
- `files_b64gz` (string): Alt to files: base64(gzip(JSON {path:content})). Use if a CDN/WAF blocks raw code in the body.
- `files_ref` (string): For a LARGE bundle that exceeds the model output-token cap: a file_id from build_stage_bundle (upload the gzip(json {path:content}) blob out-of-band, then pass its file_id here). Preferred over files…
- `force` (boolean): Publish even if validation has errors (default false).
- `project_uuid` (string, required)
- `validate` (boolean): Validate before publish (default true).

### `build_stage_bundle` (~112 tokens)

PUB-1a: get the out-of-band UPLOAD endpoint for a LARGE app bundle that won't fit inline (the model's max OUTPUT tokens cap `files`/`files_b64gz`, so big apps otherwise have to be truncated/minified). Upload a gzip(json {path:content}) blob to the returned URL with your OWN key, then pass the returned file_id as `files_ref` to build_validate / build_publish / build_doctor. Bundle size then no longer depends on any token cap.

### `build_get_bundle` (~134 tokens)

Fetch the CURRENT (or a given) PUBLISHED bundle: the file list + a signed download_url, or ONE file's content inline via file=. For ANY change request on an existing app, START from this bundle and modify it — re-authoring from scratch silently drops the hand-authored ui/app.js and every prior fix.

Input parameters:

- `file` (string): Optional app-root-relative path (e.g. 'ui/app.js') to return that single file's content inline (~120KB cap, truncated with a note).
- `project_uuid` (string, required)
- `version_uuid` (string): Default: latest published version.

### `build_deploy` (~131 tokens)

Deploy a published version. target='cloud_ephemeral' (managed Cloud Run, ~30m throwaway preview; requires platform enablement; the default when cloud deploy is enabled) or 'local' (hand the user the bundle to run with the project's own key). For a PERMANENT public URL, use build_go_live instead.

Input parameters:

- `app_type` (string): Default 'web'.
- `project_uuid` (string, required)
- `target` (string): Default 'cloud_ephemeral' when cloud deploy is enabled (else 'local').
- `version_uuid` (string): Default: latest published version.

### `build_deploy_status` (~91 tokens)

Poll a cloud deploy started by build_deploy or build_go_live. Pass the poll_url it returned. Reports elapsed_s since launch; a launch still pending after ~5 minutes should be treated as failed.

Input parameters:

- `permanent` (boolean): Set true when polling a build_go_live (permanent) deploy so the expiry guidance is correct. Default: auto-detected.
- `poll_url` (string, required)

### `build_logs` (~101 tokens)

Fetch recent Cloud Run logs for a project's deployed app — THE tool for diagnosing a failed/stalled cloud deploy or a crashing app (startup-probe timeouts, tracebacks, 'container failed to start on PORT'). Read-only; rate-limited per domain.

Input parameters:

- `lines` (integer): Max log lines to return (default 200).
- `project_uuid` (string, required)
- `since` (integer): How many minutes back to fetch (default 60).

### `build_go_live` (~162 tokens)

PERMANENT deploy: promote a published version to a PERMANENT public URL at <service>.supero.live (managed Cloud Run) — unlike build_deploy(target='cloud_ephemeral'), which is a ~30-min throwaway. If version_uuid/file_id are omitted, the latest published version for the project is used. Returns public_url + poll_url; poll with build_deploy_status until live, then build_smoke_test the public_url. build_teardown removes it. Requires a domain- or project-admin API key + platform cloud-deploy enablement.

Input parameters:

- `file_id` (string): Default: the resolved version's web artifact file_id.
- `project_uuid` (string, required)
- `version_uuid` (string): Default: latest published version.

### `build_teardown` (~132 tokens)

Tear down a project's live deployment — BOTH the permanent (build_go_live) app and the ephemeral preview — DELETEing the managed Cloud Run services and freeing their URLs. Idempotent: a project with nothing deployed returns stopped=true. ONLY manages Supero-hosted apps — a project deployed to your own AWS/GCP is refused, not silently reported stopped. Check `stopped`: false means the teardown was INCOMPLETE and the app may still be serving (and billing) — re-run it, do not report success. Requires a domain- or project-admin API key.

Input parameters:

- `project_uuid` (string, required)

### `build_list_capabilities` (~176 tokens)

List the platform's available services/integrations from the LIVE catalog (email, sms, slack, ai, stripe_checkout, google_oauth, push_notification, …) — so the intake's 'which connections/integrations?' question is accurate and you never guess a service id. Returns each service's exact catalog `service_id` (use it verbatim in config.py `services` — e.g. 'stripe_checkout', NOT 'stripe'), category, whether it needs a key, and YOUR connection's service permissions (can_import / can_configure). Descriptive — what EXISTS, never what to use. Pass service_id for one service's config fields.

Input parameters:

- `category` (string): Optional filter ('integration' or 'service').
- `service_id` (string): Optional: one service's detail incl. config fields.

### `build_recommend_integrations` (~236 tokens)

RECOMMEND which concrete provider integrations this app needs, and WHY — the deterministic Step-2 intelligence the web wizard uses, now over MCP. Pass the app `description` + the platform `service_ids` it will use (e.g. ['cart','order']); returns GROUPED, TIERED suggestions (required/recommended/optional) with the default option flagged — e.g. cart/checkout → a payment gateway (REQUIRED; stripe_checkout default, paypal/razorpay offered), customer-facing apps → transactional email, appointments+reminders → sms. Options are drawn ONLY from the LIVE installed manifests, so it can't suggest a provider you don't have. PRESCRIPTIVE complement to build_list_capabilities (which is descriptive): call this so you don't OMIT a needed integration; use build_list_capabilities for a service's exact id + config fields.

Input parameters:

- `description` (string): The app description / intent (drives email/sms/oauth/ai/payment triggers).
- `service_ids` (array): Platform service ids the app will use (e.g. ['cart','order','appointment']). Drives most recommendations.

### `build_configure_services` (~201 tokens)

Configure a service's keys for the project so an integration works at deploy (e.g. wire SendGrid for email, a Stripe TEST key for checkout). TEST/SANDBOX keys ONLY. Keys with a clear live marker (Stripe sk_live_… / Razorpay rzp_live_…) are auto-refused, but most providers give NO test-vs-live signal — so for EVERY provider send test/sandbox keys only and use the admin panel for production secrets (a deep link is returned). Never put a real secret through this tool/chat. Reacts to the live permission result; secret values are never echoed.

Input parameters:

- `config` (object, required): Test/sandbox config key→value (e.g. {"sendgrid_api_key":"SG.test…"}). Live-marked keys refused; send test keys only.
- `project_uuid` (string, required)
- `service_id` (string, required): Catalog id (e.g. 'stripe_checkout', 'email').

### `build_doctor` (~214 tokens)

PREFLIGHT a bundle BEFORE publish/deploy — catches the silent deploy-killers build_validate does NOT: missing #supero-preloader removal (app stuck on a spinner forever), heavy startup seed (Cloud Run port-bind timeout → 'container failed to start'), reserved field names like status/state (silently dropped), namespace collisions (ambiguous reads), and services needing elevated import permission. Run it after build_validate and before build_publish.

Input parameters:

- `files` (object, required): Map of {relative_path: file_content}.
- `files_b64gz` (string): Alt to files: base64(gzip(JSON {path:content})).
- `files_ref` (string): For a LARGE bundle that exceeds the model output-token cap: a file_id from build_stage_bundle (upload the gzip(json {path:content}) blob out-of-band, then pass its file_id here). Preferred over files…
- `project_uuid` (string): Target project (enables namespace + collision checks).

### `build_smoke_test` (~348 tokens)

VERIFY a DEPLOYED app actually works (not just 'running'). HTTP-checks the live URL: root loads with a title, app.js is your bundle (not a stub) and dismisses the boot splash, config.js namespace matches the project; optionally logs in and reads an entity to confirm data + no namespace ambiguity. Pass url= (from build_deploy_status) or poll_url=. THE post-deploy gate — run it after every deploy.

Input parameters:

- `email` (string): Optional — a user to log in and verify data reads.
- `entity` (string): Optional bare schema slug (e.g. 'participant') to read for the authed data check.
- `expected_app_js_sha1` (string): Optional — the first 12 lowercase hex chars of `sha1sum ui/app.js` (sha1 of your local bundle FILE). If given, smoke_test reports whether the DEPLOYED app.js matches, so you can confirm the deploy ac…
- `password` (string): Optional — password for that user.
- `poll_url` (string): Alt to url: the build_deploy poll_url; the URL is resolved from it.
- `project_uuid` (string, required): The deployed project (for namespace + live_url).
- `tenant` (string): Optional tenant for the login. Default '' so the server resolves the user's OWN tenant (required for a multi-tenant app whose test user lives in a named tenant).
- `url` (string): The deployed app URL (from build_deploy_status).

### `build_e2e_test` (~300 tokens)

Run the FULL behavioural test suite against a PUBLISHED bundle in the project's OWN already-deployed app (no throwaway project is created) — auth/RBAC/multi-tenant, CRUD round-trips, workflows + event emission, services, aggregates, real-browser UI. WRITE-SAFE: on a DEV project the write suites create + delete only their OWN test records (your real data stays read-only); a LIVE project is auto-restricted to read-only suites so production data is never mutated. This is the deep complement to build_smoke_test ('loads + reads one row'); it proves the app actually WORKS. COSTS A FULL RUN (~2-4 min of real compute) — a PRE-DELIVERY gate, NOT a per-edit check; run it after build_validate + build_doctor pass, on a deployed + seeded project. ASYNC: returns a run_id; poll build_e2e_test_status. Findings are layer-attributed so you know which are yours to fix (app/config) vs. report (platform/sdk). Requires platform enablement.

Input parameters:

- `live_email` (boolean): Actually send a test email (default false → audit-only).
- `project_uuid` (string, required): The project the published bundle belongs to.
- `suites` (array): Subset to run (default ['all']). Skipping a core suite caps the verdict.
- `version_uuid` (string): Published version to test. Default: latest.

### `build_e2e_test_status` (~118 tokens)

Poll an e2e run started by build_e2e_test. While running, returns status only. When complete, returns a compact report: verdict (honest — never 'healthy' if a core suite couldn't run), per-suite pass/fail/warn/skip, findings with layer + fix hint, what was/wasn't covered, and next_steps that say which findings to fix vs. report. On failure it carries a cause.

Input parameters:

- `run_id` (string, required): The run_id from build_e2e_test.

### `build_list_data_sources` (~110 tokens)

List the external DATA SOURCE types an app can connect to — its own Postgres/MySQL/MSSQL/Oracle/MongoDB, any REST API, or a Snowflake/BigQuery/Redshift/Databricks/ClickHouse/Fabric warehouse — plus the curated public-API catalog. Read this to offer a 'connect your own data' option. Flow: build_connect_data_source → build_discover_source → build_bind_data_source. See build_get_skills(doc='connectors').

### `build_connect_data_source` (~306 tokens)

Create a data connector to an EXTERNAL source the app owner controls (their own database, a REST API, or a warehouse). Returns a connector_id. Does NOT bind schemas yet — run build_discover_source then build_bind_data_source. Credentials are sent to the platform and NEVER echoed back; prefer read-only DB creds / the Key Store for production. Requires a domain- or project-admin API key.

Input parameters:

- `auth` (object): api kind: {type: none|api_key|bearer|basic|oauth2, ...}.
- `base_url` (string): api kind: API base URL.
- `config` (object): Extra source config (e.g. warehouse account).
- `database` (string)
- `db_type` (string): database/warehouse: postgresql|mysql|mssql|oracle|mongodb|snowflake|bigquery|redshift|databricks|clickhouse|fabric.
- `endpoint` (string): api kind: endpoint path.
- `host` (string)
- `kind` (string, required): Source kind.
- `name` (string, required): Connector name (unique within the project).
- `password` (string): DB password — sent to the platform, never echoed.
- `port` (integer)
- `schema_namespace` (string): Namespace for schemas from this source.
- `ssl_mode` (string)
- `test_first` (boolean): Probe connectivity before creating (default true).
- `username` (string)

### `build_discover_source` (~164 tokens)

Discover a connector's schema: trigger discovery, wait, and return the source streams (names, columns, primary keys), AI-inferred Supero schemas, field mappings, and a suggested namespace. Run AFTER build_connect_data_source and BEFORE build_bind_data_source (a live bind's `source` MUST equal a discovered stream name).

Input parameters:

- `connector_id` (string, required)
- `execution_id` (string): RESUME polling an in-flight discovery (from a previous timeout error) instead of starting a new job.
- `timeout` (integer): Max seconds to wait IN THIS CALL (default 60, cap 90 — an MCP call must finish under the ~100s edge limit). On timeout, resume with the returned execution_id; the job keeps running server-side.

### `build_bind_data_source` (~128 tokens)

Bind source streams to the app's schemas. mode='live_read' (default: read-only BYODB / warehouse), 'live_readwrite' (BYODB read+write — DOMAIN-ADMIN only), or 'sync' (copy into SuperoDB). For live modes, discovery must have run and each binding's `source` must match a discovered stream; the bind VERIFIES the live mapping materialized. Bound live schemas are read/written via ORDINARY app CRUD — nothing goes in the bundle.

Input parameters:

- `bindings` (array, required)
- `connector_id` (string, required)

### `build_run_data_source` (~97 tokens)

Trigger a SYNC RUN on a data connector and return the run id. MCP-created connectors are trigger:manual, so a mode='sync' binding copies NO rows until a run executes — call this after build_bind_data_source (and again whenever the source data changes). Live-read/warehouse bindings don't need runs (they read the source directly).

Input parameters:

- `connector_id` (string, required): The connector to run (from build_connect_data_source).

### `build_list_bound_schemas` (~86 tokens)

Classify this project's schemas: which are connector-backed vs app-authored, and each one's access mode (sync | live-ro | live-rw | warehouse). Use it so you DON'T render create/edit UI for read-only live sources (live-ro/warehouse) or regenerate/overwrite connector-discovered schemas.

Input parameters:

- `project_uuid` (string): Defaults to the key's project.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/supero-platform-supero/mcp-v1-messages#diagnostics

## Score history

- 2026-09-30: 85
- 2026-09-29: 85
- 2026-09-28: 84
- 2026-09-27: 84
- 2026-09-26: 83
- 2026-09-25: 83
- 2026-09-24: 82
- 2026-09-23: 82
- 2026-09-22: 77
- 2026-09-21: 76
- 2026-09-20: 76
- 2026-09-19: 75
- 2026-09-18: 75
- 2026-09-17: 74
- 2026-09-16: 74
- 2026-09-15: 73
- 2026-09-14: 73
- 2026-09-13: 72
- 2026-09-12: 72
- 2026-09-11: 72
- 2026-09-10: 71
- 2026-09-09: 31
- 2026-09-08: 31
- 2026-09-07: 31
- 2026-09-06: 31

## Common questions

### What is the Supero MCP server?

Supero is an MCP server listed in the public MCP registry as io.github.supero-platform/supero. Build multi-tenant apps over MCP. Schemas, CRUD, deploys, access control enforced server-side. This page covers its hosted endpoint (https://api.supero.dev/mcp/v1/messages).

### Is the Supero MCP server safe to use?

Supero scores 85 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Supero MCP server expose?

Supero exposes 64 tools: crud_search, crud_get, crud_create, crud_update, crud_delete, and 59 more. Their descriptions and schemas cost roughly 7,379 tokens of context every time the server is loaded.

### Does the Supero MCP server require authentication?

Yes. Supero asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the Supero MCP server still maintained?

Supero is still listed as active in the MCP registry. We last reached this channel on 30 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://api.supero.dev/mcp/v1/messages
- Authorisation metadata: https://api.supero.dev/.well-known/oauth-protected-resource/mcp/v1/messages
- Repository: https://github.com/supero-platform/supero-apps
- Website: https://docs.supero.dev/developers/mcp/overview
- Changelog RSS feed: https://verifymcp.io/servers/supero-platform-supero/mcp-v1-messages.xml
- Changelog JSON feed: https://verifymcp.io/servers/supero-platform-supero/mcp-v1-messages.json
- HTML version of this page: https://verifymcp.io/servers/supero-platform-supero/mcp-v1-messages